Evaluate library licenses against permissive, copyleft, and non-commercial criteria.
npx skills add https://github.com/thorwhalen/ek --skill ek-dev-licensing
Please help me install this Agent Skill. Skill: ek-dev-licensing Source: https://github.com/thorwhalen/ek/tree/main/skills/ek-dev-licensing Command: npx skills add https://github.com/thorwhalen/ek --skill ek-dev-licensing
This Skill prevents legal and commercial risk by enforcing strict license compliance for all dependencies added to the ek framework, ensuring the core remains permissive and redistribution-ready.
Consult the ek-dev-licensing skill to verify the license status and appropriate installation tier for a new library before adding it to the project.
High-intent search queries and answers about installing and using this skill.
To check open-source license compliance, evaluate the new library against permissive, copyleft, and non-commercial criteria before installation. This process validates dependencies against a curated tier map and CI license gate requirements to prevent transitive contamination.
Transitive license contamination occurs when a permissive project pulls in copyleft or non-commercial dependencies, voiding commercial redistribution readiness. Evaluating library licenses against strict criteria prevents this risk by ensuring the core remains redistribution-ready.
Classify dependencies as permissive or copyleft by applying strict license guardrails that map libraries to specific extras. This maintains a lean MIT, BSD, or Apache-2.0 core while isolating non-permissive components.
Using GPL-licensed libraries in a permissive project introduces legal risk and fails CI license gate requirements. You must identify scanner-invisible traps and replace them with audited alternatives to maintain commercial redistribution readiness.
Your CI pipeline fails when adding a new dependency because it violates CI license gate requirements. The pipeline validates all new libraries against a curated tier map to enforce strict license compliance and block non-permissive additions.
Automated license scanners have limitations in detecting scanner-invisible traps like transitive GPL contamination. Manual evaluation against a curated tier map is required to identify these risks and find audited replacements for non-compliant libraries.
yu13130122297Identify uncertainties in research framing, datasets, metrics, and baselines.
opendatahub-ioAssess Python package license compatibility using SPDX data.
zzw4257Scan project dependencies for known vulnerabilities using OWASP Dependency-Check.
Sir-chawakornCheck and validate project dependency licenses for NPM and Python packages.
